ok, so osx audit_class has nt:network, but it supports only connect and accept, right?